AI questions for boards and trustees
One page for a board or trustee meeting. What the board needs to know, the questions to ask management, and the decision to record.
Trustees and directors carry responsibility for how the organisation handles the data of the people it supports. Most boards have not discussed AI, while most organisations are already using it.
Take this to a meeting. It is written to be read cold, by someone who has not thought about the subject before.
AI: a briefing for the board
[YOUR ORGANISATION] Meeting date: [DATE] Prepared by: [NAME]
Why this is on the agenda
Across the charity sector, 79% of organisations now use AI in some form. Among small charities, 62% have no policy for it and 55% are taking no action at all on AI risks.
Use has run ahead of governance. The question for this board is not whether to adopt AI. It is whether we know what is already happening and can show we have managed it.
What we are doing now
Tools in use: [LIST, OR “none formally approved”]
Do we have an AI policy? [YES / NO / IN DRAFT]
Has a DPIA been completed? [YES / NO / NOT YET NEEDED]
Have we told the people we support? [YES / NO / NOT APPLICABLE YET]
Who is accountable for this? [NAME AND ROLE, OR “nobody yet”]
What the regulator expects
CQC says it does not assess or approve specific technologies, and that the presence or absence of AI does not predict a rating. There is no pressure to adopt, and no penalty for not adopting.
What CQC does expect is that AI is covered by the standards we already meet — particularly Regulation 17 on good governance. CQC summarises that regulation on its AI page as “adhering to regulation, effective risk management systems, and monitoring outputs”. Its principles name a data protection impact assessment directly.
The ICO requires a DPIA before AI touches personal data, and requires us to tell people before a new use of their data begins.
Questions for the board to ask management
- Which AI tools are staff actually using today, including on personal accounts?
- Which plan are they on — and does that plan come with a data processing agreement?
- Has a DPIA been done, and who signed it off?
- Who reads the AI output, how often, and does that continue after the pilot?
- What happens when it gets something wrong, and has that happened yet?
- Have the people we support been told, and did anyone object?
- Where is the data held, and can we answer a commissioner who asks?
- What is this costing, including staff time and the checking?
- What would we do if the supplier changed its terms or went out of business?
- Is anyone using AI to make decisions about people’s care? (The answer should be no.)
The three things that would worry an inspector
- Staff using personal accounts for anything about a person we support
- No DPIA for a tool already handling real data
- Checking that stopped when the pilot ended
Decision for this meeting
- Note the current position
- Approve the AI use policy at version [VERSION]
- Ask management to complete a DPIA before [DATE]
- Name [ROLE] as accountable for AI use
- Add AI to the risk register
- Review again on [DATE]
Recorded by: [NAME] Date: [DATE]